Hugh D.
Gamble 905 787 1849
Email:
hugh@PhaedraV.com
Qualifications:
· Experienced Information Technologies (IT) Security Manager and Consultant.
·
Over twenty years of
experience in IT and Software Development.
·
Design and Implementation of
Systems and Network Security Architecture.
· Keep current on industry and government standards through meetings with policy makers and attending seminars.
Employment
History:
Principal,
Phaedra V. 2002
– Present
·
Network
and systems security architecture consulting: I also monitor security threats
and legislation on an ongoing basis.
·
Software Application Architecture: Software design and
implementation from life cycle management to development of secure e-business
systems including IIS & Apache Web servers, MS SQL & MySQL Databases.
·
Technical management: vendor management, system integration, and International
projects.
Security Analyst, Empire Financial April 2004 – March 2005
·
With
good IT Security and Access Control teams in place, Empire was preparing for an
increasing emphasis on e-business by evaluating, co-ordinating, and updating
their entire security architecture. I was brought in initially
to collect and document existing security procedures, processes and policies.
Following my completion of a five hundred page Security Administration Manual,
they proceeded with the new Security Architecture. After an evaluation of LDAP Directory
Services and Identity Management vendors I continued
in the role of Security Analyst to implement a comprehensive security
management “dashboard” console, monitoring the Cisco firewall and VPN devices
and network authentications for Windows and Solaris.
Technical Lead, ICE. Dec. 1996 – Sept.
2001
·
managed
internal IT security: supervised IT department in matters of network and system
security and information privacy policy and planning. I designed and monitored
network security including the installation of firewalls, CISCO VPN hardware
with IPSec, email virus scanners. Network vulnerability
assessments with Cybercop and Nessus. Maintained OS configuration and patches for Solaris and Windows in
accordance with security best practices.
·
intrusion
detection and forensics: monitored network and system logs, tracked down attackers,
emergency response and repair
·
systems
and network design and security: designed system security architecture, VPN,
firewalls, virus scanners, OS patching for IT and client projects including:
Bank of Montreal EFS Intranet; Signature Vacations and Dominion Bond Rating
Service e-business systems. I was responsible for writing test plans, auditing
security, and re-evaluating after recommended actions had
been taken. The designs ensured security for all tiers of the
application architecture from internal databases to public web servers. Operated Noranda’s website working with
IBM for AIX systems and network security.
·
privacy
policies and statements: consulted on legal and client confidence requirements
for web projects, validated compliance of technical architecture with policy. Tracked Bill C6 compliance for clients in regulated industries.
·
e-business
software privacy and risk assessment: evaluated existing systems for
vulnerabilities, network scans, system audits.
·
LDAP:
implemented corporate directory in OpenLDAP, ported to Sun iPlanet
LDAP Directory Server. Migration towards ‘single sign on’
identity management. Some interfacing with Active Directory required for
Windows 2000 servers.
·
e-business
software architecture: worked on s/w architecture of enterprise Java eCommerce system for LaSenza
lingerie in WebSphere, Signature Vacations and
Dominion Bond Rating Service with J2EE in BEA WebLogic. Working
with the development teams to ensure proper implementation of my security
architecture.
Specific client projects in which I played a key role include: Bank of Montreal and Nortel Intranets and live
webcasts; system security design of e-business websites and transactional
systems for Signature Vacations and Dominion Bond Rating Service implemented
with J2EE in BEA WebLogic. I was solely responsible for security in the systems
and network designs, performing security audits with network and system
scanning tools, and intrusion detection and forensics.
Manager,
Advanced Systems, NTT. Jul.
1990 – Sept. 1996
·
Secure
network administration: managed a lab network with Solaris and NFS for
reliability and security at the Department of Defence.
·
Software programming: networked system programming in C++ and
Java.
·
networked
kiosk security: ensured robust and secure communication for a nation wide
network of retail kiosks, supervised primary contractors.
For the K-mart retail kiosk network I got
a colleague on the PGP development team to make us a custom version of the MD4
code for my use in password authentication when updating the kiosk database.
Staff Manager –
Engineering Design, Bell Canada. May
1986 – Sept. 1989
·
Integrated
Office Systems development: evaluated and selected vendors and products for
inclusion in the IOS product portfolio, included system security analysis of Unix minicomputers and PC LANs.
Co-op Student, Bell
Northern Research. Sept.
1983 – Sept. 1984
·
data
processing and business analysis of the pending divestiture of AT&T.
·
Expert Systems for telephony software.
Summer
Student, Atomic Energy of Canada Limited. Jun.
1980 – Aug. 1980
Programming and debugging PDP-11 assembler
code for the Therac 25 linear accelerator that was then under development in the Medical
Products Division.
Other relevant
experience:
·
UNIX:
owned and administrated networked UNIX systems since 1982.
·
Windows
2000, Windows 2003: administrate server with Active Directory.
·
University
computer security: detected and reported mainframe security violations while a
student.
·
Microsoft .NET and IBM J2EE seminars.
·
IBM Web Services training.
Education:
I have completed a B.Sc. in computer science at the
IPv6 Sage certification – Hurricane Electric
Published papers:
Perceptual Control and Layered Protocols in Interface Design I: Fundamental Concepts
International Journal of Human-Computer Studies, 50, 489-520, (1999)
M.M.Taylor, P.F.H.Farrell, H. Gamble, and J. Hollands
An Expert System Opponent for Wargaming
DCIEM Report No. 93-54, April 1995
T.R.H. Cutmore, H.D. Gamble
E-business Security whitepaper for ICE
Conferences:
8th International WWW Conference
Computers Freedom and Privacy 2000
iBAND broadband networking conference
Content Delivery Network conference
IPMulticast conference
Netscape Developers Conference
Skills:
Unix/Linux, Microsoft Windows, TCP/IP, HTTP, PKI, Firewall, VPN, LDAP, SSL, IPsec, BackTrack, Cybercop, nessus, nmap, enVision, Security Event
Monitoring, CA-Top Secret, ISO 17799, Java, C++, XML, Shell, awk, PERL, technical writing.
References:
Available on request.